6 Common Contractor Management Mistakes, and How to Avoid Them

I have watched a lot of contractor management systems get built, and the ones that fail rarely fail because somebody did not care. They fail on six specific things, and every one of them is fixable before it becomes an incident.

The stakes are not abstract. Safe Work Australia’s Key Work Health and Safety Statistics, released 16 October 2025, records 37 construction workers killed in 2024, 20% of all worker deaths that year, and construction is one of 6 industries accounting for 80% of work-related traumatic injury fatalities.⁴ Most of those sites were running subcontractors.

Mistake 1: Verifying the Company and Not the Worker.

Company prequalification is the part everyone does. Certificates of currency, a safety management plan, a policy set, an ABN, a workers compensation certificate. It is necessary, it is a real control, and it tells you nothing about the person who drives through the gate on Tuesday morning.

The law does not stop at the company either. Section 43 of the model WHS Act says a business must not direct or allow a worker to carry out work at a workplace where the regulations require that work to be done by an authorised person and the person is not authorised.¹ Regulation 81 puts the same duty on the individual: a person must not carry out a class of high risk work unless they hold the licence for that class.²

An approved supplier with an unlicensed operator on the machine is not a compliance win. Run the two checks as two separate things: the company at engagement, and the worker at assignment, against the role they are actually doing.

Mistake 2: One Global Checklist for Sites That Are Not the Same.

A single company-wide list of contractor requirements fails in both directions at once.

Set it high enough for your most demanding site and every worker on your books is chasing a document that only one facility wants. Set it at the average and the aged care facility that requires a police check, or the substation that requires a specific access authorisation, quietly falls through.

The fix is structural, not administrative. Hold the base requirements against the role, and the extras against the site. In ComplyFlow, a worker category carries its own document requests and mandatory tests, so every traffic controller or plant operator inherits the same standard the moment they are assigned to it.⁷ Site-level requirements then handle the exceptions: additional qualifications such as working with children checks or high risk work licences, needed at specific sites or facilities and not applicable across the account, appear on the dashboard of anyone assigned to that site.⁶

Mistake 3: Expiry Dates Nobody Owns.

This is the most common finding in any contractor audit, and it is almost never a systems problem to begin with. It is an ownership problem.

Somebody collected the certificate. Nobody was given the job of noticing it died. The expiry date exists, on the PDF, where no report can see it, and the folder still says the worker is cleared.

Two habits fix it. Capture the expiry date at the moment the document is uploaded, so the record knows when it lapses rather than relying on someone reading the certificate again later. Then run renewals as a standing report instead of a memory: in ComplyFlow the document report covers the whole life of the account, including records rejected, expired, and never uploaded, and can be filtered by what expires within a set number of days and exported.⁸

Then name the person who owns that report. A report nobody is rostered to read is the same as no report.

Mistake 4: An Induction That Is a Video, Not a Check.

An induction has two jobs: telling a worker something they need to know, and establishing that they know it. A video with a tick box at the end does the first and pretends to do the second.

The white card is where this shows up most clearly, because people treat it as a permanent credential and it is not. WorkSafe Victoria states that construction induction training must be delivered face to face by an approved registered training organisation, must run for a minimum of 6 hours, requires photo identification on the day, and cannot be delivered online.³ Under regulation 317, a business must not direct or allow a worker to carry out construction work unless they have completed that training, and the training lapses where the holder has not carried out construction work in the preceding 2 years.²

Your own site induction is a separate requirement again, and it is the one that should be hardest to fake. Regulation 39 requires the information, training, and instruction given to a worker to be suitable and adequate having regard to the nature of the work, the risks, and the control measures implemented, and to be provided in a way that is readily understandable.² That means the induction covers this site, these hazards, and this week’s work, and that the completion is recorded against the person rather than against a sign-in sheet.

Mistake 5: No Evidence Trail, So the Work Cannot Be Shown.

The work gets done. The check happens. A supervisor looks at the licence, satisfies himself, and waves the bloke through. None of it is written down, and six months later it did not happen.

This is the finding that hurts most, because the business is being marked down for something it actually did. An evidence trail means the check has a time, a checker, and a result attached to the person and the site, so that a client, an insurer, or an inspector can see it without anyone’s recollection.

At the gate, that means a check that leaves a record rather than a nod. In ComplyFlow a supervisor can scan the QR code on a worker’s access card or sticker with a phone camera and see their overall status, assigned categories, training, and documentation, all of it already vetted.⁹ Running that same check at the entry point is what turns a supervisor’s judgement into evidence. What an auditor then does with that trail, and the three findings that come up when it is missing, is covered in how to prepare for a compliance audit.

Mistake 6: Assuming the Duty Was Subcontracted Away.

This is the expensive one, and it is usually an honest misunderstanding rather than an attempt to dodge anything.

Section 14 of the model WHS Act is one line long: a duty cannot be transferred to another person.¹ Section 16 adds that more than one person can concurrently have the same duty, that each must comply to the standard the Act requires even where another duty holder has the same duty, and that each must discharge it to the extent they can influence and control the matter, including where an agreement purports to limit that capacity.¹

Safe Work Australia puts it in operational language for labour hire, and the point generalises to any contracting chain: the parties cannot contract out of or transfer their WHS duties to each other, and they must work together in a coordinated way.⁵ Section 46 of the Act requires exactly that, consultation, cooperation, and coordination between everyone holding a duty for the same matter, so far as is reasonably practicable.¹

In practice, coordination means agreeing who checks what and holding the answer somewhere both sides can see it. A clause in the subcontract saying the subcontractor is responsible for its workers’ training does not move the duty. It only records who is expected to do the checking.

The Pattern Underneath All Six.

Five of these six mistakes are the same mistake wearing different clothes: the record does not answer the question that actually gets asked on site. That question is never “is this a good company”. It is “is this person cleared for this work, at this site, today”.

Build the system so that question has a one-screen answer, and most of this list stops happening. That is what a workforce compliance record is for, and it is the same record your suppliers are keeping from their side, which is covered in keeping a workforce work-ready for every client.